Administrator cannot unlock a locked machine on a domain

[timbo343]

Hey Guys and Girls

 

I have come across a problem with our machines on our network running windows 7 professional. When a user locks the machine, we as administrators cannot unlock the machine forcing the currently logged on user to log off like you could in windows XP.

 

I have been doing a bit of searching on the net i found the attached zip file which contains some reg files, a couple of cmd files depending on your verison of windows (x86 or x64) and a could of DLLs. I have attached it to this message so if you do download this zip file make sure you run the cmd file (depending on your archieture of windows) in "Run as Administrator" mode as it copies a dll to the system32 folder. I got the file from reading this post How to Unlock Windows 7 Enterprise when another user has locked the screen? and thought i would share it with people. I tried the Alt+W combination but found that it activated fast user switching which wasn't ideal for us as it wasn't completely logging the logged on user off.

 

This little program allows any user of the local admin group to log off a user who has locked their machine, just like in windows XP without using fast user switching. It basically takes seconds to install and when a user locks their machine, they get the message stating that user x has locked this machine ... "This computer is locked. Only the logged on user can unlock the computer" and to unlock it you need to press control, alt, del and log in with the users details who have locked the machine.

 

Well this little installer, creates a button underneath the username and password box called "Other Credentials" and then takes you to a screen where you can select administrator unlock and enter the details of anyone who is a member of the local admin group (unfortunately our teachers are part of the local admin group due to when sims does the termly updates ). I have attached some screen shots of the problem we had and how the AdministrativeUnlock works.

 

Hope this helps someone out... its definately helped me out.

AdministrativeUnlock.zip

[DaveyPitch]

Top stuff, very useful

[mrbios]

Personally if ive ever come across that ive simply opened a command prompt and sent "shutdown -r -t 1 -m \\pcname" to reboot it. Has the same affect..... pretty much.

[User3204]

I stop the students from being able to lock machines, the staff have their own notebook / desktop, so if they lock it, it's them who unlock it..

 

I used to have an auto-logoff on the few machines we have in the teachers ICT suite, but since the only people that use these machines now are the student teachers, I'm slowly removing the machines when no-ones looking.

[timbo343]

We too stop students from locking their machines but this little install is ideal for schools where teachers lock their machines if they a have classroom machines which are static but teachers share the room. Many of times we have been called to either restart the machine, with this they can do it them selves.

[Cache]

The other option is to disable the option to switch user through Group Policy - this then reverts to the Windows XP behaviour of logging the user off if the machine is locked (can't remember the exact policy atm though)

[dgsmith]

Good stuff - looks exactly like the functionality which should have been present and means, as you say, we don't need to enable FUS! I'll definately be trying this out as we get countless requests every week to unlock Win7!

[rickypike]

Excellent, thanks for the post, this is very useful

[witch]

The other option is to disable the option to switch user through Group Policy - this then reverts to the Windows XP behaviour of logging the user off if the machine is locked (can't remember the exact policy atm though)

 

I can only find how to do this under local computer policy - does anyone know if you can do it from the server so it affects all computers? I don't have local admins (yet!) so the other method isn't any good to me. The problem is when a teacher leaves their laptop locked (because I told them to!) and then leaves for whatever reason,the cover person cannot get into their laptop which they need as it is connected to the whiteboard

[dgsmith]

Just installed it and tried it - works great! Definately will recommend - thanks for the heads up timbo!

[BHMS]

Enable fast user switching so if someone locks their login other people can simply login as another user.

[3s-gtech]

Fast user switching has worked for this here - but the other bonus is with AB Tutor Control, it just bludgeons its way through anyway. If you click Logoff, it'll do as it says - no matter what's stopping it!

[Cache]

I can only find how to do this under local computer policy - does anyone know if you can do it from the server so it affects all computers? I don't have local admins (yet!) so the other method isn't any good to me. The problem is when a teacher leaves their laptop locked (because I told them to!) and then leaves for whatever reason,the cover person cannot get into their laptop which they need as it is connected to the whiteboard

 

Hmmmm, I've just check the computer and it's not showing the option to unlock it so I either imaginged it or somethings changed - sorry. :/

 

If you want to disable the Fast User Switching option though it's under:

 

Administrative Templates - System - Logon - Hide entry points for Fast User Switching

 

(done from Server 2008 R2)

Edited October 20, 2011 by Cache

[FN-GM]

Only just found this i am impressed. I shall be giving this a try on my test setup and i know of a school that would find this useful.

[pooley]

Nice piece of software, works well with my Ncomputing lab

[cromertech]

Impero has a new option in v3.1.somethingorother that will unlock a pc and re-lock it again (useful for if a staff member sends a ticket to helpdesk and I try and fix when they are out of the room). It seems to me that if it's possible just to kill the lock screen you should be able to do it with a command.

[FN-GM]

I can also confirm this works, been testing tonight. I plan to put this into production during the next change window.

 

I am going to be testing this with RDS/Terminal Servers tomorrow.

[russdev]

Impero has a new option in v3.1.somethingorother that will unlock a pc and re-lock it again (useful for if a staff member sends a ticket to helpdesk and I try and fix when they are out of the room). It seems to me that if it's possible just to kill the lock screen you should be able to do it with a command.

 

We do under the admin menu can unlock and lock a windows station. Not an easy thing to do kill lock screen so doubt there is a command associated with it certainly isn't using method that Impero uses to unlock it...

 

Russ

[FN-GM]

I can also confirm this works, been testing tonight. I plan to put this into production during the next change window.

 

I am going to be testing this with RDS/Terminal Servers tomorrow.

 

After testing it works just fine with RDS

[Edu-IT]

We do under the admin menu can unlock and lock a windows station. Not an easy thing to do kill lock screen so doubt there is a command associated with it certainly isn't using method that Impero uses to unlock it...

 

Russ

How does Impero do it? Is that unlock any station, regardless of user?

[howartp]

How does Impero do it? Is that unlock any station, regardless of user?

And should it work on XP? It unlocks our Win7 machines but not XP.

 

Peter

[russdev]

And should it work on XP? It unlocks our Win7 machines but not XP.

 

Peter

 

How does Impero unlock the screen on Windows Vista and above its all in the secret sauce

 

Honestly I am not sure exact method but we do not replace files on system like in the OP what I can tell you functions we use to do it don't exist in XP hence why that Impero function will not work on XP clients.

 

Russell

[john]

How does Impero unlock the screen on Windows Vista and above its all in the secret sauce

 

Honestly I am not sure exact method but we do not replace files on system like in the OP what I can tell you functions we use to do it don't exist in XP hence why that Impero function will not work on XP clients.

 

Russell

 

Indeed it is magic sauce and VERY helpful magic source Well worth the cost of Impero just for this feature

[sonofsanta]

Bit of a necro, but... has anyone had any problems using the solution in OP? I saw it on TechNet yesterday while discovering this problem for the first time myself (thanks a lot, MS) but am generally a bit edgy about custom DLLs. Do updates/service packs overwrite it? Has anyone had any security problems with it?

[dgsmith]

Bit of a necro, but... has anyone had any problems using the solution in OP? I saw it on TechNet yesterday while discovering this problem for the first time myself (thanks a lot, MS) but am generally a bit edgy about custom DLLs. Do updates/service packs overwrite it? Has anyone had any security problems with it?

 

Been running it on our RM network for 9 months (since the start of this thread) and every RM update and Microsoft Update we have installed has not affected this in any way - continues to work flawlessly on every Win7 computer. I couldn't say whether installing any update would behave this way, or indeed a SP over an existing install as we build from new images when updating service packs, but otherwise have seen no issues.